critical9.8
CVE-2017-16228
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in t…
Impact
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dulwich Project | Dulwich | through 0.18.4 |
References
- NVD record
- CVE.org record
- https://tracker.debian.org/news/882440
- https://www.dulwich.io/code/dulwich/
- https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6/
- https://tracker.debian.org/news/882440
- https://www.dulwich.io/code/dulwich/
- https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6/